LaunchGuard vs vas
Two scanners aimed at AI-built apps, built on opposite bets. LaunchGuard attacks your live app from the outside and, in its own words, only sees what is public. vas can also sign in with test credentials and check the thing an external scan cannot reach: whether one logged-in user can actually read another user's data. Full comparison below, including where LaunchGuard wins.
Who wrote this: we build vas, so read accordingly. Every LaunchGuard claim below comes from their own public site, checked in August 2026. Where they are better, we have said so, because a comparison you cannot verify is worth nothing to you.
The short answer
Choose vas if your real worry is whether one user can reach another user's data. vas signs into your app with test credentials and tries it, and it keeps scanning weekly with copy-paste fixes on a paid plan.
Choose LaunchGuard if you want a genuinely free full scan with no signup, want every finding backed by the exact HTTP request and a curl command you can rerun, or want custom tests that rerun automatically on every deploy.
Where vas is stronger
One of these matters far more than the rest, so it goes first.
It signs in and tests the access rules
Give vas optional test credentials and it logs into your app and attempts to read records belonging to a different user, across up to 150 pages. LaunchGuard states it only sees what is public, so it tests your app from outside without a session. An external scan cannot tell whether a logged-in user A can read user B's rows, because the endpoint returns 200 whether the policy holds or not. That authenticated check is where the most common critical Supabase misconfiguration actually lives.
It keeps watching after launch
On Pro ($39/month) vas re-runs the full deep scan weekly with monitoring and breach monitoring, so a regression introduced after launch is caught, not just the state on the day you first scanned.
Where LaunchGuard wins
Free full scan, no signup. LaunchGuard returns complete results without an account. vas gives a free first scan with your score and counts, but reveals one finding in full and gates the rest.
Reproducible evidence. Each LaunchGuard finding includes the actual HTTP request, response, and a curl command so you can verify it yourself.
Custom tests on every deploy. You can have Claude Code write app-specific tests that LaunchGuard reruns after each deployment.
Side by side
| LaunchGuard | vas | |
|---|---|---|
| Authenticated (signed-in) testing | Public surface only | Yes, with test credentials |
| Exposed secrets and DB checks | Yes | Yes |
| Free scan without signup | Yes | Free first scan (one finding revealed) |
| Ongoing monitoring | Rescan on deploy | Weekly deep scan on Pro |
| Paid price | Not published (Aug 2026) | Go $19/mo, Pro $39/mo |
Frequently asked
What is the difference between LaunchGuard and vas?
LaunchGuard scans your live app from the outside and, in its own words, only sees what is public. vas can also sign in with optional test credentials and check whether one logged-in user can read another user's data, across up to 150 pages. LaunchGuard's free scan needs no signup; vas gives a free first scan with your score and issue counts.
Is LaunchGuard free?
LaunchGuard offers a free full scan with no signup, and a Pro tier that rescans on every deployment. LaunchGuard did not publish a Pro price on its site as of August 2026. vas is free for your first scan, then Go is $19/month and Pro is $39/month.
Which should I use for a Supabase app?
Both detect exposed Supabase data from outside. The difference is authenticated testing: vas signs in and checks whether your row-level-security policies actually scope data to its owner, which an external-only scan cannot verify because the endpoint returns 200 whether the rule holds or not.
Test whether your access rules actually hold
Run your first vas scan free to see your security score and issue counts. Add test credentials on a paid plan and vas signs in to check whether one user can reach another's data.